Weaknesses of type CWE-667

154 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2022-49536MEDIUMscsi: lpfc: Fix SCSI I/O completion and abort handler deadlockEPSS 0.2%CVE-2026-42490MEDIUMdomctl lock open to abuseEPSS 0.2%CVE-2022-49311MEDIUMdrivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()EPSS 0.2%CVE-2021-20315—A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" orEPSS 0.2%CVE-2022-49406MEDIUMblock: Fix potential deadlock in blk_ia_range_sysfs_show()EPSS 0.2%CVE-2022-49327MEDIUMbcache: avoid journal no-space deadlock by reserving 1 journal bucketEPSS 0.2%CVE-2021-47637MEDIUMubifs: Fix deadlock in concurrent rename whiteout and inode writebackEPSS 0.2%CVE-2026-80126MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking EPSS 0.2%CVE-2024-57949MEDIUMirqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()EPSS 0.2%CVE-2021-47632MEDIUMpowerpc/set_memory: Avoid spinlock recursion in change_page_attr()EPSS 0.2%CVE-2024-47143MEDIUMdma-debug: fix a possible deadlock on radix_lockEPSS 0.2%CVE-2024-53052MEDIUMio_uring/rw: fix missing NOWAIT check for O_DIRECT start writeEPSS 0.2%CVE-2023-3889HIGHMali GPU Kernel Driver exposes sensitive data from freed memoryEPSS 0.2%CVE-2024-55642MEDIUMblock: Prevent potential deadlocks in zone write plug error recoveryEPSS 0.2%CVE-2025-1221MEDIUMDoS in Zigbee device due to heavy trafficEPSS 0.2%CVE-2022-48671MEDIUMcgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()EPSS 0.2%CVE-2025-21849MEDIUMdrm/i915/gt: Use spin_lock_irqsave() in interruptible contextEPSS 0.2%CVE-2024-53079HIGHmm/thp: fix deferred split unqueue naming and lockingEPSS 0.2%CVE-2024-53047MEDIUMmptcp: init: protect sched with rcu_read_lockEPSS 0.2%CVE-2022-4129MEDIUMA flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condiEPSS 0.2%